InfoSecBulletin Cybersecurity for mankind
Microsoft has released patches for two critical security flaws in Azure AI Face Service and Microsoft Account that could allow an attacker to escalate their privileges.
The flaws are listed below:
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru
CISA Warns Active Exploitation of Apple iOS Security Flaw
Massive IoT Data Breach Exposes 2.7 Billion Records
SonicWall Firewall Auth Bypass Vulnerability Exploited in Wild
AMD Patches High-Severity SMM Vulns Affecting EPYC and Ryzen Processors
Lazarus Group Unleashes New Malware Against Developers Worldwide
Daily Security Update Dated : 15.02.2025
Salt Typhoon to target Bangladeshi Universities, One identified
CVE-2025-21396 (CVSS score: 7.5) – Microsoft Account Elevation of Privilege Vulnerability
CVE-2025-21415 (CVSS score: 9.9) – Azure AI Face Service Elevation of Privilege Vulnerability
“Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network,” Microsoft in an advisory for CVE-2025-21415, crediting an anonymous researcher for reporting the flaw.
CVE-2025-21396 is a security vulnerability caused by a lack of authorization, allowing unauthorized users to gain elevated privileges on a network. It was discovered by security researcher Sugobet.
The tech giant acknowledged a proof-of-concept exploit for CVE-2025-21415 but confirmed that both vulnerabilities have been fully addressed, requiring no action from customers.
Microsoft is improving transparency by issuing CVEs for critical cloud service vulnerabilities, regardless of whether customers need to apply a patch or take other actions for security.
“As our industry matures and increasingly migrates to cloud-based services, we must be transparent about significant cybersecurity vulnerabilities that are found and fixed,” it noted back in June 2024.
“By openly sharing information about vulnerabilities that are discovered and resolved, we enable Microsoft and our partners to learn and improve. This collaborative effort contributes to the safety and resilience of our critical infrastructure.”
